{"action":"created","issue":{"url":"https://api.github.com/repos/wesnoth/wesnoth/issues/990","repository_url":"https://api.github.com/repos/wesnoth/wesnoth","labels_url":"https://api.github.com/repos/wesnoth/wesnoth/issues/990/labels{/name}","comments_url":"https://api.github.com/repos/wesnoth/wesnoth/issues/990/comments","events_url":"https://api.github.com/repos/wesnoth/wesnoth/issues/990/events","html_url":"https://github.com/wesnoth/wesnoth/pull/990","id":222628670,"number":990,"title":"[DO NOT MERGE YET] Don't store the user's password in plaintext in the prefs file","user":{"login":"CelticMinstrel","id":578731,"avatar_url":"https://avatars0.githubusercontent.com/u/578731?v=3","gravatar_id":"","url":"https://api.github.com/users/CelticMinstrel","html_url":"https://github.com/CelticMinstrel","followers_url":"https://api.github.com/users/CelticMinstrel/followers","following_url":"https://api.github.com/users/CelticMinstrel/following{/other_user}","gists_url":"https://api.github.com/users/CelticMinstrel/gists{/gist_id}","starred_url":"https://api.github.com/users/CelticMinstrel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CelticMinstrel/subscriptions","organizations_url":"https://api.github.com/users/CelticMinstrel/orgs","repos_url":"https://api.github.com/users/CelticMinstrel/repos","events_url":"https://api.github.com/users/CelticMinstrel/events{/privacy}","received_events_url":"https://api.github.com/users/CelticMinstrel/received_events","type":"User","site_admin":false},"labels":[{"id":35865190,"url":"https://api.github.com/repos/wesnoth/wesnoth/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":24,"created_at":"2017-04-19T06:04:32Z","updated_at":"2017-05-03T05:29:06Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/wesnoth/wesnoth/pulls/990","html_url":"https://github.com/wesnoth/wesnoth/pull/990","diff_url":"https://github.com/wesnoth/wesnoth/pull/990.diff","patch_url":"https://github.com/wesnoth/wesnoth/pull/990.patch"},"body":"Currently, if you tell Wesnoth to remember your password, it's stored in plaintext in the preferences file, which is very insecure. This is intended to change that. However, it's still not very secure since I only used basic XOR encryption; we'd have to swap that out for something else before merging.\r\n\r\nThat aside, comments on how this works are welcome and, in fact, required.\r\n\r\nAs a \"bonus\", this also allows the game to store separate passwords for any server/username combination you use.\r\n\r\nNot sure if @GregoryLundberg is still around, but if you are, please consider commenting.\r\n"},"comment":{"url":"https://api.github.com/repos/wesnoth/wesnoth/issues/comments/298825976","html_url":"https://github.com/wesnoth/wesnoth/pull/990#issuecomment-298825976","issue_url":"https://api.github.com/repos/wesnoth/wesnoth/issues/990","id":298825976,"user":{"login":"jyrkive","id":1665617,"avatar_url":"https://avatars2.githubusercontent.com/u/1665617?v=3","gravatar_id":"","url":"https://api.github.com/users/jyrkive","html_url":"https://github.com/jyrkive","followers_url":"https://api.github.com/users/jyrkive/followers","following_url":"https://api.github.com/users/jyrkive/following{/other_user}","gists_url":"https://api.github.com/users/jyrkive/gists{/gist_id}","starred_url":"https://api.github.com/users/jyrkive/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jyrkive/subscriptions","organizations_url":"https://api.github.com/users/jyrkive/orgs","repos_url":"https://api.github.com/users/jyrkive/repos","events_url":"https://api.github.com/users/jyrkive/events{/privacy}","received_events_url":"https://api.github.com/users/jyrkive/received_events","type":"User","site_admin":false},"created_at":"2017-05-03T05:29:06Z","updated_at":"2017-05-03T05:29:06Z","body":"Well, encryption is difficult. If you don't use the high-level API, you'd have to implement the mode of operation yourself, which would likely be even more complex than using the EVP interfaces.\r\n\r\nAlternatively, you can switch to [RC4](https://en.wikipedia.org/wiki/RC4) encryption. As a stream cipher, it doesn't need any mode of operation. RC4 has known vulnerabilities, but it isn't a problem if we don't care about sophisticated attackers."}}
{"actor":{"display_login":"jyrkive"}}